[syslog-ng] Re: file issues

[Sandor Geller]

Brian Loe wrote:
> So they have to match all of the filters?

Yes.

> I want all of the messages from 4 or 5 devices to go to one log file.
> I created a filter for each using the netmask filter. I then used
> listed each of those filter commands in the log statement...
> 
> It seems that if I add multiple netmask() statements to a single
> filter is doesn't work. If I had multiple filter() statements (with a
> single device each) to a log statement it doesn't work...

It is certainly misconfigured:

> filter f_vpn {
>        netmask(1.1.1.5/255.255.255.255) and
> netmask(1.1.1.6/255.255.255.255) and netmask(1.1.1.2/255.255.255.255);
> };
> 
> filter f_fire {
>        netmask(1.1.1.2/255.255.255.255) and
> netmask(1.1.1.10/255.255.255.255) and netmask(1.1.1
> .10/255.255.255.255) and netmask(1.1.1.212/255.255.255.255);
> };

These netmasks exclude each other. Use 'or', not 'and'.

-- 
Sandor Geller
wildy at balabit.hu